NTG異常流量監(jiān)測系統(tǒng)原理講解_第1頁
NTG異常流量監(jiān)測系統(tǒng)原理講解_第2頁
NTG異常流量監(jiān)測系統(tǒng)原理講解_第3頁
NTG異常流量監(jiān)測系統(tǒng)原理講解_第4頁
NTG異常流量監(jiān)測系統(tǒng)原理講解_第5頁
已閱讀5頁,還剩29頁未讀 繼續(xù)免費閱讀

下載本文檔

版權(quán)說明:本文檔由用戶提供并上傳,收益歸屬內(nèi)容提供方,若內(nèi)容存在侵權(quán),請進行舉報或認領(lǐng)

文檔簡介

Understanding

NetFlowTopicsNetflowOverviewNetflowDatagramDeployNetflowNetflowOverviewFlow1.SourceAddress2.DestinationAddress3.SourcePort4.DestinationPort5.Layer3Protocol6.TOSByte(DSCP)7.InputInterfaceSevenKeys

DefineaFlow:NetFlowDataExportedNetflowEmpowersuserswiththeabilitytocharacterizetheirIPdataflowsThewho,what,where,when,andhowmuchIPtrafficquestionsareansweredUsageInformationTrafficAnalysis

andMonitoringforNetworkPlanningRouterFeatureAccelerationNetFlowUsingUDPtosendmultipleflowrecordsinonepacketFormatsVersion1(V1)Version5(V5)Version7(V7)Version8(V8)Version9(V9)Versions2,3,4,and6werenotreleasedFlowRecordFlowRecordFlowRecordFlowRecordHeaderSequenceNumberRecordCountVersionNumberNetFlowSequence

RouterCreateandupdateflowsinNetFlowCacheInactivetimerexpired(15secisdefault)

Activetimerexpired(30min(1800sec)isdefault)NetFlowcacheisfull(oldestflowsareexpired)RSTorFINTCPFlagHeaderExportPacketPayload(flows)ExpirationAggregation?e.g.Protocol-PortAggregationSchemebecomesExportVersionYesNoAggregatedFlows–exportVersion8or9Non-AggregatedFlows–exportVersion5or9TransportProtocolNetflowDatagramNetflowVersionsNetflowV1theoriginalformatsupportedintheinitialNetFlowreleases.NetflowV5AddsBorderGatewayProtocol(BGP)autonomoussysteminformationandflowsequencenumbers.NetflowV7exclusivelysupportsCiscoCatalyst5000seriesswitcheswithaNetFlowfeaturecard(NFFC).NotcompatiblewithCiscorouters.NetflowV8Addsrouter-basedaggregationschemes.NetflowV9Flexible,extensiblefileexportformattoenableeasiersupportofadditionalfields&technologies;comingoutnowMPLS,Multicast,&BGPNextHopNetflowHeadersVersionCount(No.ofRecords)SysUptimeUnix_secsUnix_nsecsFlow_sequesceEngine_typeEngine_idAggregationAgg_version(=2)Version1Version5Version8Version:NetflowVersionNumberCount:ThenumberofrecordsinPDUFlow_sequence:Sequencenumber totalflowsseenAggregation:Aggregationmethod beingused Sampling_intervalSampling_interval:thesampling type(2bits)andintervalVersion7Count(No.ofFlowSet)SourceIDVersion9NetflowV1FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePortOutputInterfacePortTypeofServiceTCPFlags(CumulativeOR)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationRouting

andPeeringPortUtilizationFrom/ToNextHopAddressNetflowV5FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePortOutputInterfacePortTypeofServiceTCPFlags(CumulativeOR)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationRouting

andPeeringPortUtilizationFrom/ToNextHopAddressSourceASNumberDest.ASNumberSourcePrefixMaskDest.PrefixMaskNetflowV7FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePort(0)OutputInterfacePortTypeofService(1stpkt)TCPFlags(0)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationPortUtilizationFrom/ToRouter_scShort-cutRouterRouting

andPeeringNextHopAddress(0)SourceASNumber(0)Dest.ASNumber(0)SourcePrefixMask(0)Dest.PrefixMask(0)NetflowSamplingSampled–GSRonlyForspeedshigherthanOC-3stronglyrecommendedOnlyusedinV5andV9Rangefrom10to16382(packets)Defaultintervalis4billion(toprotecttherouterfrombeingchokedbyamisconfiguration)NetflowV9A

exportformatFlexibleandextensibleStillapushmodelSentthetemplateregularly(configurable)Independentoftheunderlyingprotocol,itisreadyforanyreliableprotocol(ie:TCP,SCTP)NetFlowv9

ExportPacketHeaderDataFlowSetTemplateFlowSetOptionTemplateFlowSetFlowSetID#1DataFlowSetFlowSetID#2TemplateID(specificFieldtypesandlengths)(version,#packets,sequence#,SourceID)MatchingID#sisthewaytoassociateTemplatetotheDataRecordsTheHeaderfollowsthesameformataspriorNetFlowversionssoCollectorswillbebackwardcompatibleEachDataRecordrepresentsoneflowIfexportedflowshavethesamefieldsthentheycanbecontainedinthesameTemplateRecorde.g.unicasttrafficcanbecombinedwithmulticastrecordsIfexportedflowshavedifferentfieldsthentheycan’tbecontainedinthesameTemplateRecorde.g.BGPnext-hopcan’tbecombinedwithMPLSAwareNetFlowrecordsFlowsfromInterfaceAFlowsfromInterfaceBTosupporttechnologiessuchasMPLSorMulticast,thisexportformatcanbeleveragedtoeasilyinsertnewfieldsOptionDataFlowSetFlowSetIDOptionDataRecord(Fieldvalues)OptionDataRecord(Fieldvalues)TemplateRecordTemplateID#2(specificFieldtypesandlengths)TemplateRecordTemplateID#1(specificFieldtypesandlengths)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)NetFlowv9

FlexibleFormatHeaderTemplateFlowSetDataFlowSetFlowSetIDDataFlowSetFlowSetIDExampleofExportPacketrightafterrouterbootorNetFlowconfigurationExampleofExportPacketscontainingmostlyflowinformationOptionDataFlowSetFlowSetIDHeaderOptionDataRecord(Fieldvalues)OptionDataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)(version,#packets,sequence#,SourceID)(version,#packets,sequence#,SourceID)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)OptionTemplateFlowSetTemplateID(specificFieldtypesandlengths)NetFlowv9

ExportPacketIETFSpecificationOptionFlowsetssenddataassociatedwith:SystemInterfaceLineCardCacheTemplateExample:ThesamplingrateassociatedwithaparticularinterfaceNetFlowv9

SolutionsbyTechnologyMPLSIPV6MulticastBGPNext-hopNetFlowv9

MPLSAwareNetFlow

IPFieldsSourceanddestinationIPaddressInputandoutputsub-interfacesTransportlayerprotocolSourceanddestinationapplicationportnumbers8bitIPTypeofService(ToS)TCPFlags(accumulationfromallpacketsintheflow)MPLSFieldsUptothreeincomingMPLSlabelswithexperimental(EXP)bitsandend-of-stack(S)bitPositionofeachofthethreelabelsTypeofthetoplabelIPaddressassociatedwiththetoplabelTraditionalNetFlowFieldsNumberofpacketsNumberofbytes(counteitherIPorMPLSheader/payload)Time-stampsoffirstandlastpacketsintheflowMPLSTraditionalNetFlow

forIPtoMPLStrafficPEPPEEgressMPLSNetFlowAccountingIPinformationonlyIdealforbillingCurrentavailability:CiscoIOSSoftwareReleases12.0(10)STand12.1(5)T

MPLSAwareNetFlow(version9)ExportsuptothreeMPLSlabels,andIPpacketinformationIdealforTrafficEngineeringWillbeavailableinCiscoIOSSoftwareReleases12.0(24)S,12.2S,and12.3TrafficFlowIPIPEgressMPLSNetFlowAccountingforMPLStoIPtrafficMPLSAwareNetFlow

(version9)NetFlowv9

MPLSAwareNetFlowNetFlowv9

Multicast

TraditionalNetFlowMulticastNetFlowIngressMulticastNetFlowEgressNetFlowv9

Multicast-TraditionalNetFlowEth0Eth3Eth1Eth2InterfaceEthernet0 iproute-cacheflowipflow-exportversion9ipflow-exportdestination9995NetFlowCollectorserverTraditionalNetFlowconfiguration(S,G)-(,00)FlowRecordCreatedinNetFlowCacheThereisonlyoneflowperNetFlowconfiguredinputinterfaceThe7KeyfieldsthatdefineauniqueflowaremarkedinredDestinationinterfaceismarkedas“Null”BytesandPacketsaretheincomingvaluesNetFlowv9

Multicast-NetFlowIngressInterfaceEthernet0 ipmulticastnetflowingressipflow-exportversion9ipflow-exportdestination9995MulticastNetFlowIngressconfigurationFlowRecordCreatedinNetFlowCacheThereisonlyoneflowperNetFlowconfiguredinputinterfaceThe7KeyfieldsthatdefineauniqueflowaremarkedinredDestinationinterfaceismarkedas“Null”BytesandPacketsaretheoutgoingvaluesEth0Eth3Eth1Eth2NetFlowCollectorserver(S,G)-(,00)NetFlowv9

Multicast-NetFlowEgressInterfaceEthernet1 ipmulticastnetflowegressInterfaceEthernet2 ipmulticastnetflowegressInterfaceEthernet3 ipmulticastnetflowegressipflow-exportversion9ipflow-exportdestination9995MulticastNetFlowEgressconfigurationFlowRecordsCreatedinNetFlowCacheThereisoneflowperMulticastNetFlowEgressconfiguredoutputinterfaceOneofthe7KeyfieldsthatdefineauniqueflowhaschangedfromSourceInterfacetoDestinationInterfaceBytesandPacketsaretheoutgoingvaluesEth0Eth3Eth1Eth2NetFlowCollectorserver(S,G)-(,00)NetFlowv9

BGPNextHopSupportedonlyinversion9exportFortrafficengineering/analysisandpossiblebillingapplicationsFieldsthatareexportedincludeallthosefoundinversion5exportWillbesupportedinCiscoIOSSoftwareReleases12.0(26)S,12.2S,and12.3NetFlowv9

IPv6IPv6SourceAddressIPv6SourceMaskIPv6DestinationAddressIPv6DestinationMaskIPv6NextHopIPv6OptionHeadersBit15Bit14Bit13Bit12Bit11Bit10Bit9Bit8ReservedReservedReservedReservedreservedEncryptedSecurityPayload(50)Authenticationheader(51)PayloadcompressionHeader(108)Bit7Bit6Bit5Bit4Bit3Bit2Bit1Bit0DestinationoptionHeader(60)Hop-by-hopoptionHeade(0)reservedCannotreachlayer4header(compressed,encrypted,Notsupported)Fragmentationheader(44)–firstfragmentRoutingheaderFragmentationheader(44)–notFirstfragmentreservedDeployNetflow

ConfiguringNetflowV1,V5

(partialcommandlist)SetupNetflowV1,V5ExportonCiscoRouterConfigureNetflowExportRouter(config)#ipflow-exportversion{1|5}{origin-as|peer-as}Router(config)#ipflow-exportdestination[NTGIPaddr][portnumber]Router(config)#ipflow-cachetimeoutactive[timeoutseconds]Router(config)#ipflow-exportsource<interface>Router(config)#ipflow-cachefeature-accelerateEnableaninterfaceforNetflowRouter(config)#interface<interfacename>Router(config-if)#iproute-cacheflowSetupNetflowV5ExportonFoundryBigIronwithVM1CardorJetCoreConfigureNetflowBigIron(config)#ipflow-exportenableBigIron(config)#ipflow-exportversion5BigIron(config)#ipflow-exportdestination[NTGIPaddr][portnumber]BigIron(config)#ipflow-exportoriginal-asEnableaninterfaceforNetflowRouter(config)#interface<interfacename>Router(config-if)#iproute-cacheflowCheckNetflowSettingRouter#showipflowexport

OPTIONALNetflowPlatformSupport

(Cisco)

*SupportforNetFlowExportv1,v5,andv8on1600and2500platformsistargetedforCiscoIOSsoftwarerelease12.0(5)T.NetFlowsupportfortheseplatformswillnotbeavailableintheCiscoIOS12.0mainlinerelease.CiscoIOS?SoftwareReleaseVersionSupportedNetFlowExportVersion(s)SupportedCiscoHardwarePlatforms11.1CA,11.1CC11.2,11.2P11.2P11.3,11.3T12.0

12.0T

12.0S12.0(3)Tandlater

12.0(3)Sandlater

12.04XEN/A

12.0(6)Sv1,v5v1v1v1v1,v5

v1,v5

v1,v5,v8

v1

溫馨提示

  • 1. 本站所有資源如無特殊說明,都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請下載最新的WinRAR軟件解壓。
  • 2. 本站的文檔不包含任何第三方提供的附件圖紙等,如果需要附件,請聯(lián)系上傳者。文件的所有權(quán)益歸上傳用戶所有。
  • 3. 本站RAR壓縮包中若帶圖紙,網(wǎng)頁內(nèi)容里面會有圖紙預覽,若沒有圖紙預覽就沒有圖紙。
  • 4. 未經(jīng)權(quán)益所有人同意不得將文件中的內(nèi)容挪作商業(yè)或盈利用途。
  • 5. 人人文庫網(wǎng)僅提供信息存儲空間,僅對用戶上傳內(nèi)容的表現(xiàn)方式做保護處理,對用戶上傳分享的文檔內(nèi)容本身不做任何修改或編輯,并不能對任何下載內(nèi)容負責。
  • 6. 下載文件中如有侵權(quán)或不適當內(nèi)容,請與我們聯(lián)系,我們立即糾正。
  • 7. 本站不保證下載資源的準確性、安全性和完整性, 同時也不承擔用戶因使用這些下載資源對自己和他人造成任何形式的傷害或損失。

評論

0/150

提交評論